IBM: Vulnerabilities fell in 2009, but other risks abound

IBM's latest X-Force report says there are fewer software bugs overall, but many in document and multimedia applications

The number of software vulnerabilities fell overall in 2009, but the number of bugs in document readers and multimedia applications increased by 50 percent, according to IBM's annual X-Force Trend and Risk Report.

IBM's X-Force research and development team studies vulnerability disclosures and collects other data on Web-based attacks. In 2009, the team recorded 6,601 new vulnerabilities, which is 11 percent less than in 2008.

But IBM said the number of vulnerability disclosures for document readers, editors and multimedia applications rose by 50 percent. IBM classifies those as client-side vulnerabilities, which also include vulnerabilities affecting browsers and operating systems.

Of the five most prevalent Web site exploits, three involved PDF (Portable Document Format) files. Attackers have had much success in finding vulnerabilities in Adobe's PDF software and conduct attacks through spam campaigns and malicious Web sites.

"There's definitely a group of bad guys out there that are targeting that piece of software," said Tom Cross, IBM X-Force research manager.

The other two exploits involved Flash and an ActiveX control that allows people to view a Microsoft Office document in Internet Explorer, IBM said.

Browsers had the most client-side vulnerabilities, IBM said. Mozilla's Firefox had twice the number of critical to high vulnerabilities as Internet Explorer in 2009, but on the bright side, none of those problems were left unpatched by the end of the year.

More than half of the critical to high client-side vulnerabilities affected just four vendors: Microsoft, Adobe, Mozilla and Apple, IBM said. While on average most vendors patch 66 percent of those outstanding vulnerabilities, Apple proved the worst, patching just 38 percent.

IBM also looked at overall patching rates. The X-Force said Research In Motion, the GNU community, Cisco Systems, Adobe Systems and Hewlett-Packard had "stellar" records. Cisco only had 1 percent of its critical to high vulnerabilities left without patches by the end of the year, while the rest had none.

Those with the highest percentages of those types of unpatched vulnerabilities were the Linux community at 53 percent, Oracle at 38 percent, Novell at 31 percent and IBM at 27 percent.

The X-Force also took a look at Web application vulnerabilities, a potentially dangerous condition for Web sites that could result in data loss and other harm.

The news isn't great: Some 67 percent of Web application problems did not have a patch by the end of 2009. Cross-site scripting overtook SQL injection as the number-one type of Web application vulnerability disclosure, IBM said.

Cross-site scripting is an attack in which a script is allowed to run that shouldn't, which can be used to steal information. SQL injection occurs when input commands are validated and instead executed by a back-end database, which also can reveal data, among other malicious uses.

The number of SQL injection attacks seen by IBM in 2008 was around 5,000 a day, Cross said. In 2009, IBM was seeing upwards of a million SQL injection attacks a day as attackers used automated tools to find weak Web sites, he said.

Many times hackers sought to insert HTML into a Web page via SQL injection that causes people to be redirected to another site.

The hackers are "trying to get that malicious link in a legitimate Web site that has an audience, and that audience will be redirected to the exploit" Web site, Cross said. IBM said it also saw a massive increase in malicious Web links in 2009.

While the number of SQL injection vulnerability disclosures fell in 2009, many Web applications are custom-built, so they may have many more problems than commonly used Web apps.

"The importance of identifying and fixing Web application vulnerabilities has never been greater than it is right now," Cross said.

Join the CSO newsletter!

Error: Please check your email address.

Tags exploits and vulnerabilitiesIBMsecurityX-Forcemarket research

More about Adobe SystemsAdobe SystemsAppleCiscoCiscoHewlett-Packard AustraliaIBM AustraliaIBM AustraliaLinuxMicrosoftMotionMozillaNovellNUOracleResearch In MotionX-Force

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jeremy Kirk

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place